Executive brief
Hybrid Composer, a WordPress framework used for building custom themes and pages, contains a critical security flaw that allows anyone on the internet to change the website's internal settings. By exploiting this, an attacker can enable public user registration and set the default new user role to 'administrator.' This effectively allows an unauthorized person to create their own administrative account and take full control of the website, potentially leading to data theft or complete site defacement.
Technical details
The vulnerability exists in the 'hc_ajax_save_option' function within the Hybrid Composer framework. The function is registered as a non-private AJAX hook ('wp_ajax_nopriv_hc_ajax_save_option'), making it accessible to unauthenticated users. It fails to perform any authentication or authorization checks before passing user-supplied 'option_name' and 'content' parameters directly to the WordPress 'update_option()' function. An attacker can exploit this by sending a POST request to 'admin-ajax.php' to modify critical WordPress settings, such as 'users_can_register' and 'default_role', to gain administrative access. The issue was patched in versions following 1.4.6.
Affected products
- WPTF Hybrid Composer 1.4.6 and lower
Timeline
- 2019-07-11: disclosed: Initial discovery and report by Sucuri Labs
- 2019-07-24: other: Exploit published on Exploit-DB
- 2026-06-04: advisory: NVD publication date
References
- http://wordpress.framework-y.com/
- http://wordpress.framework-y.com/hybrid-composer/
- https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update/
- https://www.exploit-db.com/exploits/47154
- https://www.vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change